CVE-2025-63296
BaseFortify
Publication date: 2025-11-10
Last updated on: 2026-02-05
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| keruistore | kerui_k259_firmware | 33.53.87 |
| kerui | k259 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 is a code execution flaw in its boot/update process. During startup, the script /usr/sbin/anyka_service.sh scans mounted TF/SD cards, and if it finds a file named /mnt/update.nor.sh, it copies this file to /tmp/net.sh and executes it with root privileges. This allows an attacker to execute arbitrary code as root by placing a malicious script on a mounted SD card.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with physical access to the device's SD card slot to execute arbitrary code with root privileges on the security camera. This could lead to full compromise of the device, unauthorized access to video feeds, manipulation of device functions, or use of the device as a foothold into a larger network.